A message transmission system, method and device

Abstract

The disclosed embodiment provides a message transmission system, method and device, the system comprising: a session management function network element and multiple user plane function network elements, each user plane function network element is used to generate a first message for the first message generation requirement when the user plane function network element meets the preset first message generation requirement; the first message is encrypted using the encryption method associated with the user plane function network element to obtain a first encrypted message; the session management function network element is used to determine the virtual address information carried by the first encrypted message after receiving the first encrypted message; based on the association relationship between the preset virtual address information and the decryption method, the decryption method associated with the virtual address information is determined, and the first encrypted message is decrypted according to the associated decryption method to obtain the first message. This solution can improve the security of communication between the user plane function network element and the session management function network element in the sinking scenario.

Description

Technical Field

[0001] The present disclosure relates to the technical field of message transmission, and in particular to a message transmission system, method and device. Background Art

[0002] The 5G (5th Generation Mobile Communication Technology) core network is used to manage data transmission in the 5G network, including UPF (User Plane Function), SMF (Session Management Function), etc. The user plane function network element in the 5G core network can be deployed independently from other network elements such as the management function network element. For example, in order to improve communication efficiency and reduce network latency, multiple user plane function network elements can be deployed closer to user terminals, such as public places, private network user parks, etc.

[0003] In the process of a user terminal realizing a session through any user plane function network element, the user plane function network element needs to transmit messages with the session management function network element. However, since the user plane function network element and the management function network element are deployed separately, the data of the message between the user plane function network element and the session management function network element is at risk of information leakage and tampering. Therefore, how to improve the communication security between multiple user plane function network elements and session management function network elements deployed downward is a technical problem that needs to be solved urgently. Summary of the invention

[0004] The purpose of the embodiments of the present disclosure is to provide a message transmission system, method and device to improve the communication security between multiple user plane function network elements and session management function network elements deployed downward. The specific technical solution is as follows:

[0005] In a first aspect, an embodiment of the present disclosure provides a message transmission system, including: a session management function network element and a plurality of user plane function network elements, wherein:

[0006] Each user plane function network element is used to generate a first message for the first message generation requirement when the user plane function network element meets the preset first message generation requirement; encrypt the first message using the encryption method associated with the user plane function network element to obtain a first encrypted message; send the first encrypted message to the session management function network element; wherein the encryption method associated with each user plane function network element is: the encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing the virtual address information corresponding to the user plane function network element; the virtual address information corresponding to each user plane function network element is: the address information agreed in advance between the user plane function network element and the session management function network element;

[0007] The session management function network element is used to determine the virtual address information carried by the first encrypted message after receiving the first encrypted message; determine the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypt the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information.

[0008] Optionally, the encryption method associated with each user plane function network element is: using the key associated with the user plane function network element to encrypt the first message, and using the virtual address information corresponding to the user plane function network element and the encrypted data obtained by encryption to generate a message as the first encrypted message; wherein the key associated with each user plane function network element is: the key pre-agreed between the user plane function network element and the session management function network element;

[0009] The decryption method associated with each virtual address information is: using the key associated with the user plane function network element corresponding to the virtual address information to decrypt the encrypted data in the encrypted message carrying the virtual address information.

[0010] Optionally, the session management function network element is further configured to send first data indicating key update to the user plane function network element that meets the preset update condition when any user plane function network element meets the preset update condition;

[0011] The user plane function network element that meets the preset update condition is further used to receive the first data, update the key associated with the user plane function network element based on the first data; generate second data indicating generation of the updated key based on the first data, and send the second data to the session management function network element;

[0012] The session management function network element is further used for:

[0013] Receive the second data, and based on the second data, update the key corresponding to the virtual address information corresponding to the user plane function network element that meets the preset update condition.

[0014] Optionally, the preset update condition includes at least one of the following conditions:

[0015] The usage time of the key associated with the user plane functional network element is greater than the preset time threshold;

[0016] The number of times the key associated with the user plane functional network element is used is greater than a preset number threshold;

[0017] The amount of message data corresponding to the key associated with the user plane functional network element is greater than the preset data volume threshold; wherein the amount of message data corresponding to each key is: the total data volume of the message encrypted using the key, or the total data volume of the encrypted message obtained by encrypting using the key.

[0018] Optionally, the session management function network element is further configured to select at least one alternative encryption method from at least one encryption method that can be adopted by the session management function network element; and send the at least one alternative encryption method to the user plane function network element for which the encryption method is to be agreed upon;

[0019] The user plane function network element of the encryption method to be agreed upon is used to receive the at least one alternative encryption method; select an alternative encryption method from the at least one alternative encryption method as a target alternative encryption method; and send the target alternative encryption method to the session management function network element;

[0020] The session management function network element is further used to receive the target alternative encryption mode; determine a decryption mode that matches the target alternative encryption mode; and send an encryption confirmation message to the user plane function network element of the encryption mode to be agreed upon;

[0021] The user plane function network element for which the encryption method is to be agreed upon is further configured to use the target alternative encryption method as the encryption method associated with the user plane function network element after receiving the encryption confirmation message.

[0022] Optionally, the session management function network element is further configured to send a first identity identifier to the user plane function network element of the encryption mode to be agreed upon before sending the at least one alternative encryption mode to the user plane function network element of the encryption mode to be agreed upon;

[0023] The user plane function network element of the encryption method to be agreed upon is used to receive the first identity identifier and verify whether the first identity identifier is correct; if so, send the second identity identifier of the user plane function network element of the encryption method to be agreed upon to the session management function network element;

[0024] The session management function network element is further used to receive the second identity identifier and verify whether the second identity identifier is correct; if so, send the at least one alternative encryption method to the user plane function network element for the encryption method to be agreed upon.

[0025] Optionally, the session management function network element is further configured to generate a second message for the second message generation requirement when a preset second message generation requirement for any user plane function network element is met; encrypt the second message using an encryption method associated with the user plane function network element to obtain a second encrypted message; and send the second encrypted message to the user plane function network element;

[0026] Each user plane functional network element is also used to, after receiving the second encrypted message, decrypt the second encrypted message using the decryption method associated with the user plane functional network element to obtain the second message; wherein the decryption method associated with each user plane functional network element is: a decryption method that matches the encryption method associated with the user plane functional network element.

[0027] Optionally, any user plane function network element includes: a processing module, and an encryption and decryption module, wherein:

[0028] The processing module is used to generate the first message and send the first message to the encryption and decryption module when the user plane function network element meets the preset first message generation requirement;

[0029] The encryption and decryption module is used to receive the first message, encrypt the first message using the encryption method associated with the user plane function network element to obtain the first encrypted message, send the first encrypted message to the session management function network element, and receive the second encrypted message. After receiving the second encrypted message, decrypt the second encrypted message using the decryption method associated with the user plane function network element to obtain the second message, and send the second message to the processing module.

[0030] In a second aspect, an embodiment of the present disclosure provides a message transmission method, which is applied to a session management function network element in a message transmission system, wherein the message transmission system further includes a plurality of user plane function network elements, and the method includes:

[0031] When receiving a first encrypted message sent by any user plane functional network element, determine the virtual address information carried by the first encrypted message; wherein the first encrypted message is obtained by encrypting the first message using the encryption method associated with the user plane functional network element; the first message is a message generated for the first message generation requirement when the user plane functional network element meets the preset first message generation requirement; the encryption method associated with each user plane functional network element is: the encryption method agreed in advance between the user plane functional network element and the session management functional network element for generating an encrypted message containing the virtual address information corresponding to the user plane functional network element; the virtual address information corresponding to each user plane functional network element is: the address information agreed in advance between the user plane functional network element and the session management functional network element;

[0032] Based on the preset association relationship between the virtual address information and the decryption method, determine the decryption method associated with the determined virtual address information; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information;

[0033] The first encrypted message is decrypted according to the determined decryption method to obtain the first message.

[0034] Optionally, the method further comprises:

[0035] When a preset second message generation requirement for any user plane functional network element is met, generating a second message for the second message generation requirement;

[0036] Encrypting the second message by using the encryption method associated with the user plane function network element to obtain a second encrypted message;

[0037] The second encrypted message is sent to the user plane function network element, so that after receiving the second encrypted message, the user plane function network element uses the decryption method associated with the user plane function network element to decrypt the second encrypted message and obtain the second message; wherein the decryption method associated with each user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

[0038] In a third aspect, an embodiment of the present disclosure provides a message transmission method, which is applied to a user plane function network element in a message transmission system, wherein the message transmission system further includes a session management function network element, and the method includes:

[0039] When the user plane function network element meets the preset first message generation requirement, generating a first message for the first message generation requirement;

[0040] The first message is encrypted using the encryption method associated with the user plane function network element to obtain a first encrypted message; wherein the encryption method associated with the user plane function network element is: an encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing virtual address information corresponding to the user plane function network element; the virtual address information corresponding to the user plane function network element is: address information agreed in advance between the user plane function network element and the session management function network element;

[0041] The first encrypted message is sent to the session management function network element; so that the session management function network element, after receiving the first encrypted message, determines the virtual address information carried by the first encrypted message, determines the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypts the first encrypted message according to the determined decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information.

[0042] Optionally, the method further comprises:

[0043] When a second encrypted message sent by a session management function network element is received, the second encrypted message is decrypted using the decryption method associated with the user plane function network element to obtain the second message; wherein the second encrypted message is obtained by encrypting the second message using the encryption method associated with the user plane function network element; the second message is generated by the session management function network element when a preset second message generation requirement for the user plane function network element is met; the decryption method associated with the user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

[0044] In a fourth aspect, an embodiment of the present disclosure provides a message transmission device, which is applied to a session management function network element in a message transmission system, wherein the message transmission system further includes a plurality of user plane function network elements, and the device includes:

[0045] A first determination module is configured to determine the virtual address information carried by a first encrypted message sent by any user plane functional network element when the first encrypted message is received; wherein the first encrypted message is obtained by encrypting the first message using the encryption method associated with the user plane functional network element; the first message is a message generated for the first message generation requirement when the user plane functional network element meets the preset first message generation requirement; the encryption method associated with each user plane functional network element is: the encryption method agreed in advance between the user plane functional network element and the session management functional network element for generating an encrypted message containing the virtual address information corresponding to the user plane functional network element; the virtual address information corresponding to each user plane functional network element is: the address information agreed in advance between the user plane functional network element and the session management functional network element;

[0046] A second determination module is used to determine the decryption method associated with the determined virtual address information based on the preset association relationship between the virtual address information and the decryption method; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information;

[0047] A decryption module is used to decrypt the first encrypted message according to the determined decryption method to obtain the first message.

[0048] In a fifth aspect, an embodiment of the present disclosure provides a message transmission device, which is applied to a user plane function network element in a message transmission system, wherein the message transmission system further includes a session management function network element, and the device includes:

[0049] A generating module, configured to generate a first message for the first message generation requirement when the user plane functional network element meets the preset first message generation requirement;

[0050] an encryption module, configured to encrypt the first message by using the encryption method associated with the user plane function network element to obtain a first encrypted message; wherein the encryption method associated with the user plane function network element is: an encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing virtual address information corresponding to the user plane function network element; the virtual address information corresponding to the user plane function network element is: address information agreed in advance between the user plane function network element and the session management function network element;

[0051] A sending module is used to send the first encrypted message to the session management function network element; so that the session management function network element, after receiving the first encrypted message, determines the virtual address information carried by the first encrypted message, determines the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypts the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information.

[0052] In a sixth aspect, an embodiment of the present disclosure provides an electronic device, characterized in that it includes a processor, a communication interface, a memory, and a communication bus, wherein the processor, the communication interface, and the memory communicate with each other through the communication bus;

[0053] Memory, used to store computer programs;

[0054] The processor is used to implement the steps of the above data transmission method when executing the program stored in the memory.

[0055] In a seventh aspect, an embodiment of the present disclosure provides a computer-readable storage medium, characterized in that a computer program is stored in the computer-readable storage medium, and the computer program implements the steps of the above-mentioned data transmission method when executed by a processor.

[0056] Beneficial effects of the embodiments of the present disclosure:

[0057] A message transmission system provided by an embodiment of the present disclosure includes: a session management function network element and multiple user plane function network elements, wherein: each user plane function network element, after generating a first message at the user plane function network element; uses an encryption method associated with the user plane function network element to encrypt the first message to obtain a first encrypted message; and then sends the first encrypted message to the session management function network element; after receiving the first encrypted message, the session management function network element determines virtual address information carried by the first encrypted message, and based on the correspondence between the preset virtual address information and the decryption method, determines the decryption method associated with the determined virtual address information, and decrypts the first encrypted message according to the decryption method to obtain the first message. In this solution, the encryption method corresponding to the preset virtual address information is used to encrypt the information transmitted between multiple user plane function network elements and session management function network elements, and the decryption method corresponding to the virtual address information is used to decrypt the transmission information. The messages between multiple user plane function network elements and session management function network elements are in an encrypted state during the transmission process. Therefore, through this solution, the security of communication between user plane function network elements and session management function network elements is improved.

[0058] Of course, it is not necessary to achieve all the advantages described above at the same time to implement any product or method of the present disclosure. BRIEF DESCRIPTION OF THE DRAWINGS

[0059] In order to more clearly illustrate the embodiments of the present disclosure or the technical solutions in the prior art, the drawings required for use in the embodiments or the description of the prior art will be briefly introduced below. Obviously, the drawings in the following description are only some embodiments of the present disclosure, and for ordinary technicians in this field, other embodiments can also be obtained based on these drawings.

[0060] Figure 1 A scenario diagram of a user plane functional network element scenario deployed downward;

[0061] Figure 2 A schematic diagram of the interaction between a session management function network element and a user plane function network element;

[0062] Figure 3 A schematic diagram of the structure of a message transmission system provided by an embodiment of the present disclosure;

[0063] Figure 4 A schematic diagram of the interaction between a session management function network element and a user plane function network element provided in an embodiment of the present disclosure;

[0064] Figure 5 A scene diagram of a user plane function network element scene deployed downwardly provided in an embodiment of the present disclosure;

[0065] Figure 6 A flowchart of a message transmission method applied to a session management function network element provided by an embodiment of the present disclosure;

[0066] Figure 7 Another flow chart of the message transmission method applied to the session management function network element provided by the embodiment of the present disclosure;

[0067] Figure 8 A schematic diagram of the structure of a message transmission device applied to a session management function network element provided by an embodiment of the present disclosure;

[0068] Fig. 9 Another structural diagram of a message transmission device applied to a session management function network element provided by an embodiment of the present disclosure;

[0069] Fig.10 A schematic diagram of the structure of an electronic device provided by an embodiment of the present disclosure. DETAILED DESCRIPTION

[0070] The following will be combined with the drawings in the embodiments of the present disclosure to clearly and completely describe the technical solutions in the embodiments of the present disclosure. Obviously, the described embodiments are only part of the embodiments of the present disclosure, rather than all the embodiments. Based on the embodiments in the present disclosure, all other embodiments obtained by ordinary technicians in this field based on the present disclosure belong to the scope of protection of the present disclosure.

[0071] Scenarios for user plane function elements deployed downlink: Figure 1 As shown, the large network user terminal and the private network user terminal are connected through the base station and the user plane function network element deployed downward. The interface connecting the base station and the user plane function network element deployed downward is called the N3 interface. In order to reduce the latency of the private network and meet the purpose of not leaving the campus, the user plane function network element needs to be deployed downward to the computer room of the customer campus. After the private network user terminal establishes a session, it connects to the private network server through the user plane function network element deployed downward to achieve access to the private network data network. The 5G core network is generally deployed in the operator's computer room network. The user plane function network element deployed downward communicates with the user plane function network element in the 5G core network through the bearer network to provide data network access for the large network user terminal that establishes the session. The interface connecting different user plane function network elements is called the N9 interface. In the process of establishing a session with the user terminal, the session management function network element needs to transmit messages with the user plane function network element to achieve session management.

[0072] In the 5G core network, the interface connecting the user plane function network element and the session management function network element is called the N4 interface. One session management function network element is often connected to multiple user plane function network elements. In the scenario of sinking user plane function network elements, each user plane function network element needs to establish a connection with the session management function network element in advance, and then transmit the message of the subsequent session process, such as Figure 2 As shown, the session management function network element initiates an Association Setup Request of the PFCP (Packet Forwarding Control Protocol) protocol to the user plane function network element, and the user plane function network element replies to the session management function network element with an Association Setup Response of the PFCP protocol. In the process of establishing the connection, the data transmitted between the session management function network element and the user plane function network element is directly encapsulated using the real address of the N4 interface of the session management function network element and the user plane function network element. In this process, since multiple user plane function network elements are deployed separately from the management function network element, it is easy to cause the real address of the N4 interface to be leaked.

[0073] When a user terminal establishes a session with a data network through any user plane functional network element, the session management functional network element will initiate a Session Establishment Request of the PFCP protocol to the user plane functional network element, and the user plane functional network element will reply to the session management functional network element with a Session Establishment Response of the PFCP protocol. In this process, the data transmitted between the session management functional network element and the user plane functional network element is still encapsulated using the real address, and the user information of the user terminal is also carried in the process, such as the IMSI (International Mobile Subscriber Identity) number, mobile phone number, data network name, etc. Since the user plane functional network element is deployed separately from the management functional network element, and PFCP plain text is used for message transmission, there is a risk of leakage of the real address and user information of the N4 interface, and tampering of the transmitted data.

[0074] It can be seen that how to improve the communication security between multiple user plane functional network elements and session management functional network elements deployed downward is a technical problem that needs to be solved urgently.

[0075] In order to improve the communication security between multiple user plane function network elements and session management function network elements deployed downward, the embodiments of the present disclosure provide a message transmission system, method and device.

[0076] The above-mentioned message transmission system may include: a session management function network element and a plurality of user plane function network elements, wherein:

[0077] Each user plane function network element is used to generate a first message for the first message generation requirement when the user plane function network element meets the preset first message generation requirement; encrypt the first message using the encryption method associated with the user plane function network element to obtain a first encrypted message; send the first encrypted message to the session management function network element; wherein the encrypted message associated with each user plane function network element is generated as follows: the encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing the virtual address information corresponding to the user plane function network element; the virtual address information corresponding to each user plane function network element is: the address information agreed in advance between the user plane function network element and the session management function network element;

[0078] A session management functional network element is used to determine the virtual address information carried by the first encrypted message after receiving the first encrypted message; determine the decryption method associated with the virtual address information carried by the first encrypted message based on a preset association relationship between the virtual address information and the decryption method, and decrypt the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane functional network element corresponding to the virtual address information.

[0079] In this solution, the encryption method associated with the preset virtual address information is used to realize encryption of information transmitted between multiple user plane function network elements and session management function network elements, and the decryption method corresponding to the virtual address information is used to realize decryption of transmitted messages. The messages between multiple user plane function network elements and session management function network elements are in an encrypted state during transmission. Therefore, through this solution, the security of communication between user plane function network elements and session management function network elements in the sinking scenario is improved.

[0080] The message transmission system provided by the embodiment of the present disclosure is exemplarily introduced below in conjunction with the accompanying drawings. Figure 3 The system includes: a session management function network element 310 and a plurality of user plane function network elements 320, wherein:

[0081] Each user plane function network element 320 is used to generate a first message for the first message generation requirement when the user plane function network element 320 meets the preset first message generation requirement; encrypt the first message using the encryption method associated with the user plane function network element 320 to obtain a first encrypted message; send the first encrypted message to the session management function network element 310; wherein the encrypted message corresponding to each user plane function network element 320 is generated as follows: the encryption method agreed in advance between the user plane function network element 320 and the session management function network element 310 for generating an encrypted message containing the virtual address information corresponding to the user plane function network element 320; the virtual address information corresponding to each user plane function network element 320 is: the address information agreed in advance between the user plane function network element 320 and the session management function network element 310;

[0082] In this embodiment, the preset first message generation requirement may be any requirement for the user plane function network element 320 to generate a message for the session management function network element 310, for example, the requirement for the user plane function network element 320 to generate a session establishment reply after receiving a session establishment request sent by the session management function network element 310, the requirement for generating a session modification reply after receiving a session modification request sent by the session management function network element 310, etc. The generated first message may be all types of messages that the user plane function network element 320 needs to send to the session management function network element 310, such as a session establishment reply, a session modification reply, etc.

[0083] In this embodiment, virtual address information can be pre-set for the session management function network element 310 and each user plane function network element 320. At the same time, an encryption method for communicating with the session management function network element 310 can be pre-set for each user plane function network element 320. Each user plane function network element 320 has a virtual address information and an encryption method exists between it and the session management function network element 310. Therefore, the encryption method can correspond to the virtual address information of the user plane function network element 320.

[0084] The above-mentioned associated encryption method is: an encryption method for generating an encrypted message including the virtual address information corresponding to the user plane function network element 320, specifically, when encrypting the first message, the virtual address information corresponding to the user plane function network element 320 is added to the first message. The virtual address information includes: the virtual address of the user plane function network element 320, and the virtual address of the session management function network element 310. After adding the virtual address information corresponding to the user plane function network element 320, the data information in the first message and the real addresses of the user plane function network element 320 and the session management function network element 310 are encrypted, thereby realizing the encryption of the data information in the first message and the hiding of the real addresses of the user plane function network element 320 and the session management function network element 310.

[0085] Generally speaking, the header of a message is source address information and destination address information. Therefore, for the first message, the virtual source address information can be added to the header of the first message, so that the source address information of the first message becomes the virtual address of the user plane function network element 320, and the destination address becomes the virtual address of the session management function network element 310. The encryption method can be specifically used to indicate: a key and a predetermined encryption algorithm, and the encryption process is to encrypt the real address and data information of the first message with the key and the predetermined encryption algorithm. The key is a parameter input in the algorithm for converting plaintext to ciphertext or converting ciphertext to plaintext. The encryption algorithm can be a DES (Data Encryption Standard) algorithm, a 3DES (Triple Data Encryption Algorithm, triple data encryption) algorithm, etc.

[0086] When the encryption method indicates a key and a predetermined encryption algorithm, the encryption method associated with each user plane function network element 320 is to use the key associated with the user plane function network element 320 to encrypt the first message to obtain encrypted data, and then use the virtual address information corresponding to the user plane function network element 320 and the obtained encrypted data to generate a message as the first encrypted message.

[0087] The key associated with each of the above user plane function network elements 320 is: the key pre-agreed between the user plane function network element 320 and the session management function network element 310;

[0088] In this embodiment, the real address information and data information of the first message can be encrypted using the key associated with the user plane function network element 320 to obtain encrypted data, and then a virtual source address is added to the encrypted data as a header to obtain a first encrypted message.

[0089] The session management function network element 310 is used to determine the virtual address information carried by the first encrypted message after receiving the first encrypted message; determine the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypt the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element 320 corresponding to the virtual address information.

[0090] In the case where the encryption method indicates a key and a predetermined encryption algorithm, the decryption method associated with each virtual address information is: using the key associated with the user plane function network element corresponding to the virtual address information to decrypt the encrypted data in the encrypted message carrying the virtual address information.

[0091] The decryption method may specifically be used to indicate: a key and a predetermined decryption algorithm. The key used in the decryption process may be the same as the key used in the encryption process, and the decryption algorithm is the inverse operation of the above encryption algorithm.

[0092] In this embodiment, since each user plane functional network element 320 has a virtual address information, the association relationship between the virtual address information and the decryption method of each user plane functional network element 320 can be pre-set. In this way, after receiving the first encrypted message, the session management functional network element 310 can search for a decryption method that matches the virtual address information based on the virtual address information carried by the first encrypted message, and then decrypt the first encrypted message according to the decryption method to obtain the first message before encryption, thereby obtaining the real address information and data information in the first message for subsequent message processing.

[0093] Corresponding to the process in which the user plane function network element 320 sends the first encrypted message to the session management function network element 310, the session management function network element 310 is further configured to generate a second message for the second message generation requirement when the preset second message generation requirement for any user plane function network element 320 is met; encrypt the second message using the encryption method associated with the user plane function network element 320 to obtain a second encrypted message; and send the second encrypted message to the user plane function network element 320;

[0094] The preset second message generation requirement may be any requirement for the session management function network element 310 to generate a message for any user plane function network element 320, for example, a requirement for initiating a session establishment request to the user plane function network element 320, a requirement for initiating a session establishment request to the user plane function network element 320, etc. The generated second message may be all types of messages sent by the session management function network element 310 to the user plane function network element 320, for example, a session establishment request, a session modification request, etc.

[0095] Similarly, the association between the virtual address information and the encryption method of each user plane function network element 320 can be set in advance. In this way, after generating a second message for any user plane function network element 320, the associated encryption method can be found according to the virtual address information of the user plane function network element 320, and the second message can be encrypted according to the encryption method to obtain a second encrypted message, and then the second encrypted message can be sent to the user plane function network element 320.

[0096] The encryption method corresponding to the second message may be the same as the encryption method corresponding to the first message.

[0097] Each user plane function network element 320 is further configured to, after receiving the second encrypted message, decrypt the second encrypted message using a decryption method associated with the user plane function network element 320 to obtain a second message.

[0098] Similarly, a decryption method for communicating with the session management function network element 310 can be pre-set for each user plane function network element 320. After receiving the second encrypted message, the second encrypted message is decrypted using the decryption method to obtain the real address information and data information in the second message before encryption, so as to perform subsequent data processing.

[0099] In this solution, the encryption method corresponding to the preset virtual address information is used to realize encryption of information transmitted between multiple user plane function network elements and session management function network elements, and the decryption method corresponding to the virtual address information is used to realize decryption of the transmitted information. The information between multiple user plane function network elements and session management function network elements is in an encrypted state during the transmission process. Therefore, through this solution, the security of communication between user plane function network elements and session management function network elements in the sinking scenario is improved.

[0100] In order to further improve security, the key may be updated. Optionally, in one embodiment, the session management function network element 310 may send first data indicating key update to any user plane function network element 320 that meets the preset update condition when the user plane function network element 320 meets the preset update condition;

[0101] Considering that the same key is used for a long time, there is a risk of the key being cracked. Therefore, in order to further improve the security of communication between the user plane function network element 320 and the session management function network element 310 in the sinking scenario, when the preset update condition for any user plane function network element 320 is met, the session management function network element 310 sends the first data indicating the key update to the user plane function network element 320 that meets the preset update condition. The first data indicating the key update is sent by any user plane function network element 320 to the session management function network element 310, and in this embodiment, the session management function network element 310 is taken as the sender as an example.

[0102] The above preset update condition may include at least one of the following conditions:

[0103] The usage time of the key associated with the user plane functional network element 320 is greater than the preset time threshold;

[0104] The number of times the key associated with the user plane function network element 320 is used is greater than a preset number threshold;

[0105] The amount of message data corresponding to the key associated with the user plane functional network element 320 is greater than the preset data volume threshold; wherein the amount of message data corresponding to each key is: the total data volume of the message encrypted using the key, or the total data volume of the encrypted message obtained by encrypting using the key.

[0106] Among them, the key usage duration associated with the user plane function network element 320 is greater than the preset duration threshold, which may be the number of times the key associated with the user plane function network element 320 is used, or the number of messages encrypted using the key. The message data volume corresponding to each key may be the sum of the data volume of the message encrypted using the key before encryption, or the sum of the data volume of the encrypted message obtained after encryption using the key.

[0107] In this embodiment, the above-mentioned preset update condition can be any one of the above-mentioned three conditions. For example, the above-mentioned preset update condition is that the usage duration of the key associated with the user plane function network element 320 is greater than the preset duration threshold. At this time, when the user plane function network element 320 meets this one condition, it means that the user plane function network element 320 meets the preset update condition, so that the key associated with the user plane function network element 320 can be updated.

[0108] The above-mentioned preset update conditions can also be any two of the above-mentioned three conditions or all three conditions. At this time, only when the user plane function network element 320 satisfies any two of the conditions or all three conditions at the same time, it means that the user plane function network element 320 satisfies the preset update conditions, so that the key associated with the user plane function network element 320 can be updated.

[0109] In this solution, when the user plane function network element meets the preset update conditions, the key associated with the user plane function network element can be updated, so that the key associated with the user plane function network element can be continuously updated, avoiding the use of a single key that may lead to data leakage and data tampering caused by the key being cracked, thereby further improving security.

[0110] The user plane function network element 320 that meets the preset update condition is further used to receive the first data, update the key associated with the user plane function network element 320 based on the first data; generate second data indicating the generation of the updated key based on the first data, and send the second data to the session management function network element 310;

[0111] When a preset update condition for any user plane function network element 320 is met, the session management function network element 310 generates first data, and sends the first data to the user plane function network element 320, and the user plane function network element 320 generates second data based on the first data.

[0112] In this embodiment, the key may be updated using the Diffie-Hellman (a key exchange protocol proposed by Diffie and Hellman) algorithm. The generation process of the first data may be:

[0113] The session management function network element 310 generates a prime number a, a random number XA, and a primitive root q of a, calculates YA=a^XA mod q, obtains YA, and obtains the first data a, q, and YA.

[0114] After receiving a, q, and YA, the user plane function network element 320 that meets the preset update condition generates a random number XB that is less than q, and calculates YB=a^XB mod q to obtain the second data YB.

[0115] The session management function network element 310 is further used for:

[0116] The second data is received, and based on the second data, a key corresponding to the virtual address information corresponding to the user plane function network element 320 that meets the preset update condition is updated.

[0117] After receiving YB, the session management function network element 310 calculates the value of (YB)^XA mod q to obtain a new key. At the same time, the user plane function network element 320 that meets the preset update condition can calculate the value of (YA)^XB mod q to obtain the same key. The user plane function network element 320 that meets the preset update condition can use the new key to replace the currently stored key; the session management function network element 310 can use the new key to replace the currently stored key corresponding to the virtual address information corresponding to the user plane function network element 320 that meets the preset update condition, thereby completing the key update.

[0118] In this embodiment, when the session management function network element 310 meets the preset update condition for any user plane function network element 320, the first data indicating the key update is sent to the user plane function network element 320 that meets the preset update condition; the user plane function network element 320 that meets the preset update condition receives the first data, and updates the key associated with the user plane function network element 320 based on the first data; based on the first data, second data indicating the generation of the updated key is generated, and the second data is sent to the session management function network element 310; the session management function network element 310 receives the second data, and based on the second data, updates the key corresponding to the virtual address information corresponding to the user plane function network element 320 that meets the preset update condition, and completes the key update. Through this solution, data leakage and data tampering caused by key cracking can be prevented, so the security of communication between the user plane function network element 320 and the session management function network element 310 in the sinking scenario can be further improved.

[0119] Optionally, in an embodiment of the present disclosure, in order to determine the encryption mode and the decryption mode, the session management function network element 310 is further configured to select at least one alternative encryption mode from at least one encryption mode that can be adopted by the session management function network element 310; and send the at least one alternative encryption mode to the user plane function network element 320 for which the encryption mode is to be agreed;

[0120] In this embodiment, the session management function network element 310 may use multiple encryption methods. For example, multiple configuration data for message encryption may be pre-configured in the session management function network element 310 and each user plane function network element 320, for example, configuration data for using the IPSec protocol. Taking encryption using the IPSec protocol as an example, the encryption method may specifically include: multiple working modes, multiple protection protocols, multiple authentication methods, multiple encryption algorithms, multiple key generation methods, etc. Therefore, after the session management function network element 310 and each user plane function network element 320 are pre-configured with multiple configuration data for message encryption, there will be multiple encryption methods that can be used in the session management function network element 310 and each user plane function network element 320.

[0121] At least one alternative encryption method is selected from at least one encryption method that can be adopted by the session management function network element 310, and the alternative encryption method is sent to the user plane function network element 320 for which the encryption method is to be agreed.

[0122] The user plane function network element 320 of the encryption method to be agreed upon is configured to receive at least one candidate encryption method; select an alternative encryption method from the at least one candidate encryption method as a target alternative encryption method; and send the target alternative encryption method to the session management function network element 310;

[0123] After the user plane function network element 320 of the encryption method to be agreed upon receives at least one alternative encryption method, it can select an alternative encryption method that can be used by the user plane function network element 320 of the encryption method to be agreed upon from the at least one alternative encryption method as the target alternative encryption method, and then send the target alternative encryption method to the session management function network element 310.

[0124] The session management function network element 310 is further used to receive a target candidate encryption method; determine a decryption method that matches the target candidate encryption method; and send an encryption confirmation message to the user plane function network element 320 of the encryption method to be agreed upon;

[0125] When the session management function network element 310 receives the target alternative encryption method, it can determine the target alternative encryption method as the encryption method for the user plane function network element 320 of the encryption method to be agreed upon, and determine the matching decryption method, establish an association between the encryption method and the decryption method and the virtual address information of the user plane function network element 320 of the encryption method to be agreed upon, store them locally, and then send an encryption confirmation message to the user plane function network element 320 of the encryption method to be agreed upon, notifying the user plane function network element 320 of the encryption method to be agreed upon of the encryption method associated with the user plane function network element.

[0126] The user plane function network element 320 for which the encryption method is to be agreed upon is further configured to use the target candidate encryption method as the encryption method associated with the user plane function network element after receiving the encryption confirmation message.

[0127] It can be understood that the encryption method of the user plane function network element 320 of the encryption method to be agreed upon and the encryption method of the session management function network element 310 for the user plane function network element 320 of the encryption method to be agreed upon are the same, the decryption algorithm included in the encryption method is the inverse operation of the encryption algorithm in the encryption method, and the decryption method of the user plane function network element 320 of the encryption method to be agreed upon and the session management function network element 310 for the user plane function network element 320 of the encryption method to be agreed upon are also the same.

[0128] In this embodiment, a process for agreeing on an encryption method between the session management function network element 310 and the user plane function network element 320 for which the encryption method is to be agreed upon is provided, thereby providing a basis for the subsequent encryption transmission process of messages between the session management function network element 310 and the user plane function network element 320.

[0129] The process of agreeing on the encryption method mentioned above also needs to include an identity authentication process, so that the session management function network element 310 and the user plane function network element 320 of the agreed encryption method can determine whether the other party is the correct object of the agreed encryption method. Therefore, in one embodiment of the present disclosure, the session management function network element 310 is also used to send a first identity identifier to the user plane function network element 320 of the encryption method to be agreed before sending at least one alternative encryption method to the user plane function network element 320 of the encryption method to be agreed;

[0130] The first identity identifier may be a pre-configured shared key, or a digital certificate, etc. Before sending at least one alternative encryption method to the user plane function network element 320 for the encryption method to be agreed upon, the identity identifier is first confirmed with the user plane function network element 320 for the encryption method to be agreed upon, and after both parties confirm that the identity identifier is correct, the subsequent process of agreeing on the encryption method is performed.

[0131] The user plane function network element 320 of the encryption method to be agreed upon is used to receive the first identity identifier and verify whether the first identity identifier is correct; if so, send the second identity identifier of the user plane function network element 320 of the encryption method to be agreed upon to the session management function network element 310;

[0132] The above-mentioned second identity identifier may also be a pre-configured shared key, or a digital certificate, etc. The first identity identifier and the second identity identifier may be pre-stored in the session management function network element 310 and the user plane function network element 320 of the encryption method to be agreed upon. When the user plane function network element 320 of the encryption method to be agreed upon receives the first identity identifier, it may verify whether the received first identity identifier is correct based on the stored first identity identifier of the session management function network element 310, and if correct, send the second identity identifier to the session management function network element 310.

[0133] The session management function network element 310 is further configured to receive the second identity identifier and verify whether the second identity identifier is correct; if so, to send at least one alternative encryption method to the user plane function network element 320 for the encryption method to be agreed upon.

[0134] In the above-mentioned session management function network element 310, the identity identifiers of each user plane function network element 320 can be pre-stored. After receiving the second identity identifier, it is verified whether the second identity identifier is the identity identifier of the user plane function network element 320 of the encryption method to be agreed upon. If so, the step of sending at least one alternative encryption method to the user plane function network element 320 of the encryption method to be agreed upon is executed to carry out the subsequent encryption method agreement.

[0135] Taking the IPSec protocol as an example, the above process of verifying identity and agreeing on encryption method can include two stages:

[0136] In the first stage, an IKE SA (Internet Key Exchange Security Association) is first established. This stage is used to securely perform identity authentication and protect the subsequent encryption method agreement process. In this stage, the pre-encryption method and key of the session management function network element 310 and the user plane function network element 320 whose encryption method is to be agreed upon are first agreed upon. The key and pre-encryption method are used to perform the identity authentication process and encrypt the messages transmitted during the encryption method agreement process, thereby protecting the subsequent identity authentication and encryption method agreement process.

[0137] In the second stage, an encryption method is agreed upon under the protection of IKE SA, thereby establishing an IPSec SA (security association of the network security protocol) between the session management function network element 310 and the user plane function network element 320 for which the encryption method is to be agreed upon. Then, the encryption method determined in the second stage is used to encrypt the messages transmitted between the session management function network element 310 and the user plane function network element 320 for which the encryption method is to be agreed upon.

[0138] The IPSec protocol includes the EPS (Encapsulating Security Payload) protection protocol and the AH (Authentication Header) protection protocol, wherein the AH protection protocol can prevent the transmitted data from being tampered with and does not provide data encryption, while the EPS protection protocol can provide data encryption. In this embodiment, in order to prevent information leakage in the message, the EPS (Encapsulating Security Payload) protection protocol of the IPSec protocol can be used to encrypt the messages transmitted between the session management function network element 310 and each user plane function network element 320.

[0139] Optionally, in an embodiment of the present disclosure, any user plane function network element 320 may include: a processing module, and an encryption and decryption module, wherein:

[0140] A processing module, configured to generate a first message and send the first message to the encryption and decryption module when the user plane function network element 320 meets the preset first message generation requirement;

[0141] The processing module is equivalent to the unimproved user plane function network element 320 in the related art. The processing module can also be used to process the second message after receiving the second message.

[0142] The encryption and decryption module is used to receive a first message, encrypt the first message using the encryption method associated with the user plane function network element 320 to obtain a first encrypted message, send the first encrypted message to the session management function network element 310, and receive a second encrypted message. After receiving the second encrypted message, decrypt the second encrypted message using the decryption method associated with the user plane function network element 320 to obtain a second message, and send the second message to the processing module.

[0143] The encryption and decryption module can also be used in the above-mentioned agreed encryption process, such as Figure 4 As shown, Figure 4 The present invention shows an interaction process between an encryption and decryption module, a processing module, and a session management function network element 310. First, an IKE SA is established between the session management function network element 310 and the encryption and decryption module, and then an IPSec SA is established between the session management function network element 310 and the encryption and decryption module on the basis of the established IKE SA, and the protection protocol used is determined to be ESP. After that, the session management function network element 310 and the encryption and decryption module transmit messages protected by the ESP protocol. Taking the Session Establishment Request and Session Establishment Response of the PFCP protocol as an example, first, the session management function network element 310 generates a Session Establishment Request of the PFCP protocol as the second message, and encrypts it using the associated encryption method to generate a second encrypted message, and sends the second encrypted message to the encryption and decryption module; the encryption and decryption module decrypts the second encrypted message using the associated decryption method to obtain the second message before encryption, and sends the second message to the processing module; after receiving the second message, the processing module generates a Session Establishment Response of the PFCP protocol as the first message, and sends the first message to the encryption and decryption module; the encryption and decryption module then encrypts the first message using the associated encryption method to generate a first encrypted message, and sends the first encrypted message to the session management function network element 310.

[0144] In combination with the data transmission system provided by the embodiment of the present disclosure, the user plane function network element 320 deployed downward is as follows Figure 5 As shown,

[0145] After the private network user terminal establishes a session, it connects to the private network server through the user plane function network element 320 to access the private network data network. The large network user terminal also establishes a session with the data network through the user plane function network element 320. The difference is that an IPSec tunnel is established between the user plane function network element 320 and the session management function network element 310, and the user plane function network element 320 and the session management function network element 310 communicate using the virtual address of the IPSec tunnel; the user plane function network element 320 includes an encryption and decryption module for encrypting and decrypting messages, and a processing module for generating and processing messages.

[0146] In this embodiment, the processing module is used to generate the first message, and the encryption and decryption module is used to encrypt the first message and decrypt the second message. By dividing the user plane function network element into a processing module and an encryption and decryption module, the management and maintenance of the user plane function network element functions are facilitated.

[0147] The embodiment of the present disclosure also provides a data transmission method, which is applied to a session management function network element in a message transmission system. The message transmission system also includes multiple user plane function network elements, such as Figure 6 As shown, the method includes steps S601-S603:

[0148] S601, when receiving a first encrypted message sent by any user plane functional network element, determine the virtual address information carried by the first encrypted message; wherein the first encrypted message is obtained by encrypting the first message using the encryption method associated with the user plane functional network element; the first message is a message generated for the first message generation requirement when the user plane functional network element meets the preset first message generation requirement; the encryption method associated with each user plane functional network element is: the encryption method agreed in advance between the user plane functional network element and the session management functional network element for generating an encrypted message containing the virtual address information corresponding to the user plane functional network element; the virtual address information corresponding to each user plane functional network element is: the address information agreed in advance between the user plane functional network element and the session management functional network element;

[0149] In one implementation, the encryption method associated with each user plane function network element is: using the key associated with the user plane function network element to encrypt the first message, and using the virtual address information corresponding to the user plane function network element and the encrypted data obtained by encryption to generate a message as the first encrypted message; wherein the key associated with each user plane function network element is: the key pre-agreed between the user plane function network element and the session management function network element;

[0150] The decryption method associated with each virtual address information is: using the key associated with the user plane function network element corresponding to the virtual address information to decrypt the encrypted data in the encrypted message carrying the virtual address information.

[0151] S602, based on the preset association relationship between the virtual address information and the decryption method, determine the decryption method associated with the determined virtual address information; wherein the decryption method associated with each virtual address information is: a decryption method matching the encryption method associated with the user plane function network element corresponding to the virtual address information;

[0152] S603: Decrypt the first encrypted message according to the determined decryption method to obtain a first message.

[0153] In this solution, the encryption method corresponding to the preset virtual address information is used to encrypt the information transmitted between multiple user plane function network elements and session management function network elements, and the decryption method corresponding to the virtual address information is used to decrypt the transmission information. The messages between multiple user plane function network elements and session management function network elements are in an encrypted state during the transmission process. Therefore, through this solution, the security of communication between user plane function network elements and session management function network elements is improved.

[0154] In one implementation, the data transmission method further includes:

[0155] When any user plane function network element meets the preset update condition, send first data indicating the key update to the user plane function network element that meets the preset update condition; so that the user plane function network element that meets the preset update condition updates the key associated with the user plane function network element based on the first data; based on the first data, generate second data indicating the generation of an updated key, and send the second data to the session management function network element;

[0156] The second data is received, and based on the second data, a key corresponding to the virtual address information corresponding to the user plane function network element that meets the preset update condition is updated.

[0157] In one implementation, the preset update condition includes at least one of the following conditions:

[0158] The usage time of the key associated with the user plane functional network element is greater than the preset time threshold;

[0159] The number of times the key associated with the user plane functional network element is used is greater than a preset number threshold;

[0160] The amount of message data corresponding to the key associated with the user plane functional network element is greater than the preset data volume threshold; wherein the amount of message data corresponding to each key is: the total data volume of the message encrypted using the key, or the total number of encrypted messages obtained by encrypting using the key.

[0161] In one implementation, the method for determining the encryption method associated with the user plane function network element includes:

[0162] Selecting at least one alternative encryption method from at least one encryption method that can be used by the session management function network element; sending at least one alternative encryption method to the user plane function network element for which the encryption method is to be agreed upon; so that the user plane function network element for which the encryption method is to be agreed upon selects an alternative encryption method from at least one alternative encryption method as a target alternative encryption method; sending the target alternative encryption method to the session management function network element;

[0163] Receive a target alternative encryption method; determine a decryption method that matches the target alternative encryption method; send an encryption confirmation message to the user plane functional network element for the encryption method to be agreed upon; so that the user plane functional network element for the encryption method to be agreed upon, after receiving the encryption confirmation message, uses the target alternative encryption method as the encryption method associated with the user plane functional network element.

[0164] In one implementation, before sending at least one alternative encryption method to the user plane function network element of the encryption method to be agreed upon, the data transmission method further includes:

[0165] Sending a first identity identifier to a user plane function network element for which an encryption method is to be agreed upon; so that the user plane function network element for which an encryption method is to be agreed upon receives the first identity identifier and verifies whether the first identity identifier is correct; if so, sending a second identity identifier of the user plane function network element for which an encryption method is to be agreed upon to a session management function network element;

[0166] Receive the second identity identifier and verify whether the second identity identifier is correct; if so, send at least one alternative encryption method to the user plane functional network element of the encryption method to be agreed upon.

[0167] The above is a process in which a session management function network element receives a first message sent by a user plane function network element. Accordingly, the data transmission method of an embodiment of the present disclosure further provides a process in which a session management function network element receives a second message sent by a user plane function network element:

[0168] When a preset second message generation requirement for any user plane functional network element is met, generating a second message for the second message generation requirement;

[0169] Encrypting the second message by using the encryption method associated with the user plane function network element to obtain a second encrypted message;

[0170] A second encrypted message is sent to the user plane function network element, so that after receiving the second encrypted message, the user plane function network element uses the decryption method associated with the user plane function network element to decrypt the second encrypted message to obtain a second message; wherein the decryption method associated with each user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

[0171] The data transmission method provided in the embodiment of the present disclosure can also be applied to a user plane function network element in a message transmission system, and the message transmission system also includes a session management function network element, such as Figure 7 As shown, the method may include steps S701-S703:

[0172] S701, when the user plane functional network element meets the preset first message generation requirement, generating a first message for the first message generation requirement;

[0173] S702, encrypting the first message by using the encryption method associated with the user plane function network element to obtain a first encrypted message; wherein the encryption method associated with the user plane function network element is: an encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing virtual address information corresponding to the user plane function network element; the virtual address information corresponding to the user plane function network element is: address information agreed in advance between the user plane function network element and the session management function network element;

[0174] In one implementation, the encryption method associated with each user plane function network element is: using the key associated with the user plane function network element to encrypt the first message, and using the virtual address information corresponding to the user plane function network element and the encrypted data obtained by encryption to generate a message as the first encrypted message; wherein the key associated with each user plane function network element is: the key pre-agreed between the user plane function network element and the session management function network element;

[0175] The decryption method associated with each virtual address information is: using the key associated with the user plane function network element corresponding to the virtual address information to decrypt the encrypted data in the encrypted message carrying the virtual address information.

[0176] S703, sending a first encrypted message to the session management function network element; so that the session management function network element, after receiving the first encrypted message, determines the virtual address information carried by the first encrypted message, determines the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypts the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information.

[0177] In one implementation, the data transmission method further includes:

[0178] Receive first data sent by a session management function network element when any user plane function network element meets a preset update condition; update a key associated with the user plane function network element based on the first data; generate second data indicating generation of an updated key based on the first data, and send the second data to the session management function network element, so that the session management function network element updates the key corresponding to the virtual address information corresponding to the user plane function network element that meets the preset update condition based on the second data.

[0179] In one implementation, the preset update condition includes at least one of the following conditions:

[0180] The usage time of the key associated with the user plane functional network element is greater than the preset time threshold;

[0181] The number of times the key associated with the user plane functional network element is used is greater than a preset number threshold;

[0182] The amount of message data corresponding to the key associated with the user plane functional network element is greater than the preset data volume threshold; wherein the amount of message data corresponding to each key is: the total data volume of the message encrypted using the key, or the total number of encrypted messages obtained by encrypting using the key.

[0183] In one implementation, the method for determining the encryption method associated with the user plane function network element includes:

[0184] Receiving at least one alternative encryption method sent by a session management function network element; wherein the alternative encryption method is at least one encryption method that can be used by the session management function network element;

[0185] Selecting an alternative encryption method from at least one alternative encryption method as a target alternative encryption method; sending the target alternative encryption method to a session management function network element so that the session management function network element receives the target alternative encryption method; determining a decryption method that matches the target alternative encryption method; and sending an encryption confirmation message to a user plane function network element of the encryption method to be agreed upon;

[0186] After receiving the encryption confirmation message, the target alternative encryption method is used as the encryption method associated with the user plane functional network element.

[0187] In one implementation, before receiving at least one alternative encryption method sent by the session management function network element, the data transmission method further includes:

[0188] Receive a first identity identifier sent by a session management function network element, and verify whether the first identity identifier is correct; if so, send a second identity identifier of a user plane function network element for an encryption method to be agreed upon to the session management function network element; so that the session management function network element verifies whether the second identity identifier is correct; if so, send at least one alternative encryption method to the user plane function network element for an encryption method to be agreed upon.

[0189] Likewise, the method may further include:

[0190] When a second encrypted message sent by a session management function network element is received, the second encrypted message is decrypted using the decryption method associated with the user plane function network element to obtain a second message; wherein the second encrypted message is obtained by encrypting the second message using the encryption method associated with the user plane function network element; the second message is generated by the session management function network element when the preset second message generation requirement for the user plane function network element is met; the decryption method associated with the user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

[0191] In this solution, the encryption method corresponding to the preset virtual address information is used to encrypt the information transmitted between multiple user plane function network elements and session management function network elements, and the decryption method corresponding to the virtual address information is used to decrypt the transmission information. The messages between multiple user plane function network elements and session management function network elements are in an encrypted state during the transmission process. Therefore, through this solution, the security of communication between user plane function network elements and session management function network elements is improved.

[0192] The embodiment of the present disclosure also provides a message transmission device, which is applied to a session management function network element in a message transmission system. The message transmission system also includes multiple user plane function network elements, such as Figure 8 As shown, the device comprises:

[0193] The first determination module 810 is used to determine the virtual address information carried by the first encrypted message when receiving the first encrypted message sent by any user plane function network element; wherein the first encrypted message is obtained by encrypting the first message using the encryption method associated with the user plane function network element; the first message is a message generated for the first message generation requirement when the user plane function network element meets the preset first message generation requirement; the encryption method associated with each user plane function network element is: the encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing the virtual address information corresponding to the user plane function network element; the virtual address information corresponding to each user plane function network element is: the address information agreed in advance between the user plane function network element and the session management function network element;

[0194] The second determination module 820 is used to determine the decryption method associated with the determined virtual address information based on the preset association relationship between the virtual address information and the decryption method; wherein the decryption method associated with each virtual address information is: a decryption method matching the encryption method associated with the user plane function network element corresponding to the virtual address information;

[0195] The decryption module 830 is used to decrypt the first encrypted message according to the determined decryption method to obtain the first message.

[0196] Optionally, the device may further include:

[0197] A second message generation module, configured to generate a second message for the second message generation requirement when a preset second message generation requirement for any user plane functional network element is reached;

[0198] A second message encryption module, used to encrypt the second message by using the encryption method associated with the user plane function network element to obtain a second encrypted message;

[0199] The second encrypted message sending module is used to send the second encrypted message to the user plane function network element, so that after receiving the second encrypted message, the user plane function network element uses the decryption method associated with the user plane function network element to decrypt the second encrypted message to obtain the second message; wherein the decryption method associated with each user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

[0200] The embodiment of the present disclosure also provides a message transmission device, which is applied to any one of a plurality of user plane function network elements in a message transmission system, wherein the message transmission system further includes a session management function network element, such as Fig. 9 As shown, the device may include:

[0201] A generating module 910, configured to generate a first message for the first message generation requirement when the user plane function network element meets the preset first message generation requirement;

[0202] The encryption module 920 is configured to encrypt the first message by using the encryption method associated with the user plane function network element to obtain a first encrypted message; wherein the encryption method associated with the user plane function network element is: an encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing virtual address information corresponding to the user plane function network element; the virtual address information corresponding to the user plane function network element is: address information agreed in advance between the user plane function network element and the session management function network element;

[0203] The sending module 930 is used to send the first encrypted message to the session management function network element; so that the session management function network element, after receiving the first encrypted message, determines the virtual address information carried by the first encrypted message, determines the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypts the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information.

[0204] Optionally, the device may further include:

[0205] A decryption module is used to decrypt the second encrypted message sent by the session management function network element by using the decryption method associated with the user plane function network element to obtain the second message when receiving the second encrypted message sent by the session management function network element; wherein the second encrypted message is obtained by encrypting the second message by using the encryption method associated with the user plane function network element; the second message is generated by the session management function network element when the preset second message generation requirement for the user plane function network element is met; the decryption method associated with the user plane function network element is: a decryption method matching the encryption method associated with the user plane function network element.

[0206] The present disclosure also provides an electronic device, such as Fig.10 As shown, it includes a processor 1001, a communication interface 1002, a memory 1003 and a communication bus 1004, wherein the processor 1001, the communication interface 1002, and the memory 1003 communicate with each other through the communication bus 1004.

[0207] Memory 1003, used for storing computer programs;

[0208] The processor 1001 is used to implement the steps of the above data transmission method when executing the program stored in the memory 1003.

[0209] The communication bus mentioned in the above electronic device can be a Peripheral Component Interconnect (PCI) bus or an Extended Industry Standard Architecture (EISA) bus, etc. The communication bus can be divided into an address bus, a data bus, a control bus, etc. For ease of representation, only one thick line is used in the figure, but it does not mean that there is only one bus or one type of bus.

[0210] The communication interface is used for communication between the above electronic device and other devices.

[0211] The memory may include a random access memory (RAM) or a non-volatile memory (NVM), such as at least one disk memory. Optionally, the memory may also be at least one storage device located away from the aforementioned processor.

[0212] The above-mentioned processor can be a general-purpose processor, including a central processing unit (CPU), a network processor (NP), etc.; it can also be a digital signal processor (DSP), an application specific integrated circuit (ASIC), a field programmable gate array (FPGA) or other programmable logic devices, discrete gate or transistor logic devices, discrete hardware components.

[0213] In another embodiment provided by the present disclosure, a computer-readable storage medium is provided, in which a computer program is stored. When the computer program is executed by a processor, the steps of the above-mentioned data transmission method are implemented.

[0214] In another embodiment provided by the present disclosure, a computer program product including instructions is also provided, which, when executed on a computer, enables the computer to execute the steps of the above-mentioned data transmission method.

[0215] In the above embodiments, it can be implemented in whole or in part by software, hardware, firmware or any combination thereof. When implemented by software, it can be implemented in whole or in part in the form of a computer program product. The computer program product includes one or more computer instructions. When the computer program instructions are loaded and executed on a computer, the process or function described in the embodiment of the present disclosure is generated in whole or in part. The computer can be a general-purpose computer, a special-purpose computer, a computer network, or other programmable device. The computer instructions can be stored in a computer-readable storage medium, or transmitted from one computer-readable storage medium to another computer-readable storage medium. For example, the computer instructions can be transmitted from a website site, computer, server or data center by wired (e.g., coaxial cable, optical fiber, digital subscriber line (DSL)) or wireless (e.g., infrared, wireless, microwave, etc.) mode to another website site, computer, server or data center. The computer-readable storage medium can be any available medium that a computer can access or a data storage device such as a server or data center that includes one or more available media integrated. The available medium can be a magnetic medium (e.g., a floppy disk, a hard disk, a tape), an optical medium (e.g., a DVD), or a semiconductor medium (e.g., a solid-state hard disk Solid State Disk (SSD)), etc.

[0216] It should be noted that, in this article, relational terms such as first and second, etc. are only used to distinguish one entity or operation from another entity or operation, and do not necessarily require or imply any such actual relationship or order between these entities or operations. Moreover, the terms "include", "comprise" or any other variants thereof are intended to cover non-exclusive inclusion, so that a process, method, article or device including a series of elements includes not only those elements, but also other elements not explicitly listed, or also includes elements inherent to such process, method, article or device. In the absence of further restrictions, the elements defined by the sentence "comprise a ..." do not exclude the existence of other identical elements in the process, method, article or device including the elements.

[0217] Each embodiment in this specification is described in a related manner, and the same or similar parts between the embodiments can be referred to each other, and each embodiment focuses on the differences from other embodiments. In particular, for the method embodiment, since it is basically similar to the system embodiment, the description is relatively simple, and the relevant parts can be referred to the partial description of the method embodiment.

[0218] The above description is only a preferred embodiment of the present disclosure and is not intended to limit the protection scope of the present disclosure. Any modification, equivalent replacement, improvement, etc. made within the spirit and principle of the present disclosure are included in the protection scope of the present disclosure.

Claims

1. A message transmission system, characterized in that: include: Session management function network element and multiple user plane function network elements, including: Each user plane function network element is used to generate a first message for the first message generation requirement when the user plane function network element meets the preset first message generation requirement after each user plane function network element completes identity authentication with the session management function network element; encrypt the first message using the encryption method associated with the user plane function network element to obtain a first encrypted message; send the first encrypted message to the session management function network element; wherein the encryption method associated with each user plane function network element is: the encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing the virtual address information corresponding to the user plane function network element; the virtual address information corresponding to each user plane function network element is: the address information agreed in advance between the user plane function network element and the session management function network element; The session management function network element is configured to determine the virtual address information carried by the first encrypted message after receiving the first encrypted message; determine the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypt the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method matching the encryption method associated with the user plane function network element corresponding to the virtual address information; Among them, each user plane functional network element is also used to encrypt the first message using the key and encryption algorithm predetermined by the user plane functional network element and the session management functional network element, and then add the virtual address information of the user plane functional network element and the virtual address information of the session management functional network element to the header of the encrypted first message to obtain the first encrypted message.

2. The system according to claim 1, characterized in that The decryption method associated with each virtual address information is: using the key associated with the user plane function network element corresponding to the virtual address information to decrypt the encrypted data in the encrypted message carrying the virtual address information.

3. The system according to claim 2, characterized in that The session management function network element is further configured to send first data indicating key update to the user plane function network element that meets the preset update condition when any user plane function network element meets the preset update condition; The user plane function network element that meets the preset update condition is further used to receive the first data, and update the key associated with the user plane function network element based on the first data; Based on the first data, generate second data indicating generation of the updated key, and send the second data to the session management function network element; The session management function network element is further used for: Receive the second data, and based on the second data, update the key corresponding to the virtual address information corresponding to the user plane function network element that meets the preset update condition.

4. The system according to claim 3, characterized in that The preset update condition includes at least one of the following conditions: The usage time of the key associated with the user plane functional network element is greater than the preset time threshold; The number of times the key associated with the user plane functional network element is used is greater than a preset number threshold; The amount of message data corresponding to the key associated with the user plane functional network element is greater than the preset data volume threshold; wherein the amount of message data corresponding to each key is: the total data volume of the message encrypted using the key, or the total data volume of the encrypted message obtained by encrypting using the key.

5. The system according to claim 1, characterized in that The session management function network element is further configured to select at least one alternative encryption method from at least one encryption method that can be used by the session management function network element; and send the at least one alternative encryption method to the user plane function network element for which the encryption method is to be agreed; The user plane function network element of the encryption method to be agreed upon is used to receive the at least one alternative encryption method; select an alternative encryption method from the at least one alternative encryption method as a target alternative encryption method; and send the target alternative encryption method to the session management function network element; The session management function network element is further used to receive the target alternative encryption mode; determine a decryption mode that matches the target alternative encryption mode; and send an encryption confirmation message to the user plane function network element of the encryption mode to be agreed upon; The user plane function network element for which the encryption method is to be agreed upon is further configured to use the target alternative encryption method as the encryption method associated with the user plane function network element after receiving the encryption confirmation message.

6. The system according to claim 5, characterized in that The session management function network element is further configured to send a first identity identifier to the user plane function network element for the encryption mode to be agreed upon before sending the at least one alternative encryption mode to the user plane function network element for the encryption mode to be agreed upon; The user plane function network element of the encryption method to be agreed upon is used to receive the first identity identifier and verify whether the first identity identifier is correct; if so, send the second identity identifier of the user plane function network element of the encryption method to be agreed upon to the session management function network element; The session management function network element is further used to receive the second identity identifier and verify whether the second identity identifier is correct; if so, send the at least one alternative encryption method to the user plane function network element for the encryption method to be agreed upon.

7. The system according to claim 1, characterized in that The session management function network element is further configured to generate a second message for the second message generation requirement when a preset second message generation requirement for any user plane function network element is met; Encrypting the second message by using an encryption method associated with the user plane function network element to obtain a second encrypted message; Sending the second encrypted message to the user plane function network element; Each user plane functional network element is also used to, after receiving the second encrypted message, decrypt the second encrypted message using the decryption method associated with the user plane functional network element to obtain the second message; wherein the decryption method associated with each user plane functional network element is: a decryption method that matches the encryption method associated with the user plane functional network element.

8. The system according to claim 7, characterized in that Any user plane functional network element includes: a processing module, and an encryption and decryption module, wherein: The processing module is used to generate the first message and send the first message to the encryption and decryption module when the user plane function network element meets the preset first message generation requirement; The encryption and decryption module is used to receive the first message, encrypt the first message using the encryption method associated with the user plane function network element to obtain the first encrypted message, send the first encrypted message to the session management function network element, and receive the second encrypted message. After receiving the second encrypted message, decrypt the second encrypted message using the decryption method associated with the user plane function network element to obtain the second message, and send the second message to the processing module.

9. A message transmission method, characterized in that: A session management function network element applied to a message transmission system, wherein the message transmission system further comprises a plurality of user plane function network elements, and the method comprises: After each user plane function network element completes identity authentication with the session management function network element, when receiving the first encrypted message sent by any user plane function network element, determine the virtual address information carried by the first encrypted message; wherein, the first encrypted message is obtained by encrypting the first message using the encryption method associated with the user plane function network element; the first message is a message generated for the first message generation requirement when the user plane function network element meets the preset first message generation requirement; the encryption method associated with each user plane function network element is: the encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing the virtual address information corresponding to the user plane function network element; the virtual address information corresponding to each user plane function network element is: the address information agreed in advance between the user plane function network element and the session management function network element; Based on the preset association relationship between the virtual address information and the decryption method, determine the decryption method associated with the determined virtual address information; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information; Decrypting the first encrypted message according to the determined decryption method to obtain the first message; Among them, the first encrypted message is a message obtained by encrypting the first message using the key and encryption algorithm predetermined by the user plane function network element and the session management function network element, and then adding the virtual address information of the user plane function network element and the virtual address information of the session management function network element to the header of the encrypted first message.

10. The method according to claim 9, characterized in that The method further comprises: When a preset second message generation requirement for any user plane functional network element is met, generating a second message for the second message generation requirement; Encrypting the second message by using the encryption method associated with the user plane function network element to obtain a second encrypted message; The second encrypted message is sent to the user plane function network element, so that after receiving the second encrypted message, the user plane function network element uses the decryption method associated with the user plane function network element to decrypt the second encrypted message and obtain the second message; wherein the decryption method associated with each user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

11. A message transmission method, characterized in that: A user plane function network element applied to a message transmission system, wherein the message transmission system further comprises a session management function network element, and the method comprises: After each user plane function network element completes identity authentication with the session management function network element, when the user plane function network element meets a preset first message generation requirement, generating a first message for the first message generation requirement; The first message is encrypted using the encryption method associated with the user plane function network element to obtain a first encrypted message; wherein the encryption method associated with the user plane function network element is: an encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing virtual address information corresponding to the user plane function network element; the virtual address information corresponding to the user plane function network element is: address information agreed in advance between the user plane function network element and the session management function network element; sending the first encrypted message to the session management function network element; so that the session management function network element, after receiving the first encrypted message, determines the virtual address information carried by the first encrypted message, determines the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypts the first encrypted message according to the determined decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method matching the encryption method associated with the user plane function network element corresponding to the virtual address information; Among them, the first message is encrypted using the encryption method associated with the user plane function network element to obtain the first encrypted message, including: using the key and encryption algorithm predetermined by the user plane function network element and the session management function network element to encrypt the first message, and then adding the virtual address information of the user plane function network element and the virtual address information of the session management function network element to the header of the encrypted first message to obtain the first encrypted message.

12. The method according to claim 11, characterized in that The method further comprises: When a second encrypted message sent by a session management function network element is received, the second encrypted message is decrypted using the decryption method associated with the user plane function network element to obtain a second message; wherein the second encrypted message is obtained by encrypting the second message using the encryption method associated with the user plane function network element; the second message is generated by the session management function network element when a preset second message generation requirement for the user plane function network element is met; the decryption method associated with the user plane function network element is: a decryption method that matches the encryption method associated with the user plane function network element.

13. A message transmission device, characterized in that: A session management function network element applied to a message transmission system, wherein the message transmission system further comprises a plurality of user plane function network elements, and the device comprises: The first determination module is used to determine the virtual address information carried by the first encrypted message when receiving the first encrypted message sent by any user plane function network element after each user plane function network element completes identity authentication with the session management function network element; wherein the first encrypted message is obtained by encrypting the first message using the encryption method associated with the user plane function network element; wherein the first message is a message generated for the first message generation requirement when the user plane function network element meets the preset first message generation requirement; the encryption method associated with each user plane function network element is: the user plane function network element is pre-associated with the session management function network element; an encryption method agreed upon by the session management function network element for generating an encrypted message containing the virtual address information corresponding to the user plane function network element; the virtual address information corresponding to each user plane function network element is: the address information agreed upon in advance by the user plane function network element and the session management function network element; the first encrypted message is a message obtained by encrypting the first message using a key and an encryption algorithm predetermined by the user plane function network element and the session management function network element, and then adding the virtual address information of the user plane function network element and the virtual address information of the session management function network element to the header of the encrypted first message; A second determination module is used to determine the decryption method associated with the determined virtual address information based on the preset association relationship between the virtual address information and the decryption method; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information; A decryption module is used to decrypt the first encrypted message according to the determined decryption method to obtain the first message.

14. A message transmission device, characterized in that: A user plane function network element applied to a message transmission system, wherein the message transmission system further includes a session management function network element, and the device includes: A generating module, configured to generate a first message for the first message generation requirement when the user plane function network element meets a preset first message generation requirement after each user plane function network element completes identity authentication with the session management function network element; an encryption module, configured to encrypt the first message by using an encryption method associated with the user plane function network element to obtain a first encrypted message; wherein the encryption method associated with the user plane function network element is: an encryption method agreed in advance between the user plane function network element and the session management function network element for generating an encrypted message containing virtual address information corresponding to the user plane function network element; the virtual address information corresponding to the user plane function network element is: address information agreed in advance between the user plane function network element and the session management function network element; the first encrypted message is a message obtained by encrypting the first message by using a key and an encryption algorithm predetermined by the user plane function network element and the session management function network element, and then adding the virtual address information of the user plane function network element and the virtual address information of the session management function network element to a header of the encrypted first message; A sending module is used to send the first encrypted message to the session management function network element; so that the session management function network element, after receiving the first encrypted message, determines the virtual address information carried by the first encrypted message, determines the decryption method associated with the virtual address information carried by the first encrypted message based on the preset association relationship between the virtual address information and the decryption method, and decrypts the first encrypted message according to the decryption method to obtain the first message; wherein the decryption method associated with each virtual address information is: a decryption method that matches the encryption method associated with the user plane function network element corresponding to the virtual address information.

15. An electronic device, characterized in that: It includes a processor, a communication interface, a memory and a communication bus, wherein the processor, the communication interface and the memory communicate with each other through the communication bus; Memory, used to store computer programs; A processor, for implementing any of the methods described in claims 9-12 when executing a program stored in a memory.

16. A computer-readable storage medium, characterized in that: The computer-readable storage medium stores a computer program, and when the computer program is executed by a processor, the method according to any one of claims 9 to 12 is implemented.

Images